CVE-2021-35464

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

• CWE-502
• CWE-502

• http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://backstage.forgerock.com/knowledge/kb/article/a47894244Exploit, Permissions Required, Vendor Advisory
• https://bugster.forgerock.orgBroken Link
• http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://backstage.forgerock.com/knowledge/kb/article/a47894244Exploit, Permissions Required, Vendor Advisory
• https://bugster.forgerock.orgBroken Link
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35464US Government Resource

Published

Jul 22, 2021

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35451In Teradici PCoIP Management Console-Enterprise 20.07.0, an …6.1
• CVE-2021-35452An Incorrect Access Control vulnerability exists in libde265…6.5
• CVE-2021-35456Online Pet Shop We App 1.0 is vulnerable to remote SQL injec…9.8
• CVE-2021-35458Online Pet Shop We App 1.0 is vulnerable to Union SQL Inject…9.8
• CVE-2021-3546An out-of-bounds write vulnerability was found in the virtio…8.2
• CVE-2021-35463Cross-site scripting (XSS) vulnerability in the Frontend Tag…6.1
• CVE-2021-35465Certain Arm products before 2021-08-23 do not properly consi…3.4
• CVE-2021-35469The Lexmark Printer Software G2, G3 and G4 Installation Pack…7.8
• CVE-2021-3547OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in…7.4
• CVE-2021-35472An issue was discovered in LemonLDAP::NG before 2.0.12. Sess…8.8
• CVE-2021-35473An issue was discovered in LemonLDAP::NG before 2.0.12. Ther…9.1
• CVE-2021-35474Stack-based Buffer Overflow vulnerability in cachekey plugin…9.8